[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^22.16.5 → ^26.6.4

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Monday (* 0-6 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2d7df23f-923f-4220-ad51-15527435c134

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔦 Lighthouse CI

URL	Performance	Accessibility	Best Practices	SEO
http://127.0.0.1:4173/	🟠 66	🟢 100	🟢 100	🟢 100

This repo’s lighthouserc assertions can fail this check.

[rishitank]

Self-review by Claude

Checked package.json and bun.lock. The manifest and lockfile agree: @types/node 26.6.4 is locked with undici-types 8.9.0. Typecheck, build and Browser tests are green. The Lighthouse failure is the repo-wide one handled in #11.

Note: these types describe Node 26 APIs, while CI runs on Bun. Typecheck would not catch a Node-26-only API used by mistake. That risk is low for this app. Nothing to fix.

[github-actions]

🧪 Runtime gate

✅ Runtime crawl: no runtime errors

1 page(s) opened in a real browser (desktop + phone), safe controls exercised, forms tried with dummy data, links followed client-side, missing-route probe run. 14s.

Coverage: 1/1 routes · 2/3 controls operated · 1/1 forms submitted · 39.3% of the app's own JavaScript executed

Against the default branch: routes ±0, controls ±0, JS ±0 pts.

No visual changes against the last default-branch run.

Pages visited

Page	Status	ms	Controls operated	Forms submitted	Problems
/	200	4964	2/3	1/1	0

AI explorer not run: no major/framework signal in this PR. Add the ai-explore label to request one.

Screenshots, diffs and the app log: runtime-gate artifact.

[rishitank]

Independent Claude review (cloud session)

Head reviewed: bb4e0de7ed84b896436ae5fdf44d43e60e6c21b8 (renovate/node-26.x, 1 commit). This supersedes the earlier self-review, which was on 4719a5f.

Recommendation: MERGE (low risk), with one non-blocking note. Merging is the owner's call; I have not approved or merged anything.

What changed

@types/node ^22.16.5 → ^26.6.4 in package.json. bun.lock locks @types/node@26.6.4 and moves undici-types 6.21.0 → 8.9.0. Nothing else changes and the lockfile agrees with the manifest.

Verification (fresh checkout of the head, bun install --frozen-lockfile)

Step	Result
lint	pass (0 errors)
typecheck	pass
test	pass (8 files, 264 tests)
build	pass
merged onto current main (7e5977f)	install, lint, typecheck, test and build all pass
merged together with #13	no conflicts

Local runs used Node v22.22.0 (the repo's .nvmrc is 22) and Bun 1.4.2. CI pins Bun 1.3.13, so the frozen-lockfile check passing here is supporting evidence, not identical to CI. E2E and Lighthouse were not re-run locally; I relied on CI for those.

Findings (ranked)

1. Low, non-blocking: types target Node 26, the repo targets Node 22. .nvmrc is 22 and Lighthouse CI runs Node from .nvmrc. @types/node 26 therefore declares APIs that don't exist at runtime. A mistaken use of a Node-26-only API would typecheck and then fail at runtime. Current exposure is tiny: the only Node imports are node:fs, node:path and node:url (src/lib/tokens.test.ts, vitest.config.ts), which are identical in 22 and 26. tsconfig.json sets "types": ["vite/client"], so Node globals are not ambient in app code. Suggested follow-up, not for this PR: either keep @types/node on the major matching .nvmrc (a Renovate allowedVersions rule), or bump .nvmrc and CI to a Node 26 line together.
2. Info: branch is 5 commits behind main. main has moved (vite 8.3.3, eslint-plugin-react-refresh, etc.). GitHub reports it clean and I verified the merge result passes, so no action is needed.
3. Info: no changelog. @types/node has no release notes; I found no breaking-change notes to check. undici-types 8.9.0 is a types-only transitive dependency.

Fixes

None needed, so no commits were pushed to this branch.

Gate status

• CI on this head: green. Lint/typecheck/test/build, Browser tests, Lighthouse CI, Runtime gate, Vulnerable dependencies and Secrets all pass. security / Ecosystem audit and flows are skipped, as in the workflow config.
• CodeRabbit: skipped. It posted "Review skipped: Bot user detected" on this PR. I did not trigger it, per instructions. Whether that satisfies "checked on the head" is the owner's call.
• Unresolved threads: none (0 review threads).
• Caveat: Renovate may recreate this branch, which would change the head SHA and make this review stale.

---

Generated by Claude Code